{"id":111,"date":"2026-09-29T15:39:20","date_gmt":"2026-09-29T15:39:20","guid":{"rendered":"https:\/\/roboticsmaestro.com\/ai\/?p=111"},"modified":"2026-09-29T15:43:41","modified_gmt":"2026-09-29T15:43:41","slug":"full-oauth-2-0-success-path-for-openwebui-azure-ad-and-mcp-function","status":"publish","type":"post","link":"https:\/\/roboticsmaestro.com\/ai\/blog\/2026\/09\/29\/full-oauth-2-0-success-path-for-openwebui-azure-ad-and-mcp-function\/","title":{"rendered":"Full Oauth 2.0 success path for OpenWebUI, Azure AD and MCP function"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">go <strong>all in<\/strong> and map out the <strong>full OAuth 2.0 Authorization Code with PKCE flow<\/strong> for your <strong>OpenWebUI MCP + Azure AD<\/strong> integration, showing <strong>every single step<\/strong> in the <strong>success path<\/strong> from the moment the user clicks \u201cConnect\u201d to when the MCP extension is fully authenticated.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Full OAuth 2.0 Success Path \u2014 OpenWebUI MCP + Azure AD<\/strong><\/h2>\n\n\n\n<pre class=\"wp-block-preformatted\">Copy code<code>+---------+        +----------------+        +----------------+\n|  User   |        | OpenWebUI MCP  |        | Azure AD (Entra)|\n+----+----+        +-------+--------+        +--------+-------+\n     |                     |                          |\n(1)  | Click \"Connect\"     |                          |\n     |--------------------&gt;|                          |\n     |                     |                          |\n(2)  | Generate PKCE       |                          |\n     | code_verifier &amp;     |                          |\n     | code_challenge      |                          |\n     |                     |                          |\n(3)  | Redirect user to    |                          |\n     | Azure AD \/authorize |                          |\n     | with:               |                          |\n     | - client_id         |                          |\n     | - redirect_uri      |                          |\n     | - response_type=code|                          |\n     | - scope             |                          |\n     | - state             |                          |\n     | - code_challenge    |                          |\n     | - code_challenge_method=S256                   |\n     |--------------------&gt;|                          |\n     |                     |                          |\n(4)  | Azure AD prompts    |                          |\n     | login screen        |                          |\n     |&lt;--------------------|                          |\n     | User enters creds   |                          |\n     |--------------------&gt;|                          |\n     |                     |                          |\n(5)  | Azure AD checks:    |                          |\n     | - App exists &#x2705;      |                          |\n     | - Assignment req? &#x2705; |                          |\n     | - User assigned &#x2705;   |                          |\n     | - MFA if required   |                          |\n     |                     |                          |\n(6)  | Consent screen      |                          |\n     | (if first time)     |                          |\n     |&lt;--------------------|                          |\n     | User grants consent |                          |\n     |--------------------&gt;|                          |\n     |                     |                          |\n(7)  | Azure AD issues     |                          |\n     | authorization code  |                          |\n     | + state             |                          |\n     |--------------------&gt;|                          |\n     |                     |                          |\n(8)  | OpenWebUI MCP       |                          |\n     | validates state     |                          |\n     |                     |                          |\n(9)  | MCP sends POST to   |                          |\n     | Azure AD \/token     |                          |\n     | with:               |                          |\n     | - grant_type=code   |                          |\n     | - code              |                          |\n     | - redirect_uri      |                          |\n     | - client_id         |                          |\n     | - code_verifier     |                          |\n     |--------------------&gt;|                          |\n     |                     |                          |\n(10) | Azure AD validates  |                          |\n     | code + PKCE         |                          |\n     |                     |                          |\n(11) | Azure AD returns:   |                          |\n     | - access_token      |                          |\n     | - refresh_token     |                          |\n     | - id_token (JWT)    |                          |\n     |&lt;--------------------|                          |\n     |                     |                          |\n(12) | MCP stores tokens   |                          |\n     | securely (encrypted)|                          |\n     |                     |                          |\n(13) | MCP uses            |                          |\n     | access_token to     |                          |\n     | call protected APIs |                          |\n     |--------------------&gt;|  Resource Server         |\n     |                     |                          |\n(14) | API returns data    |                          |\n     |&lt;--------------------|                          |\n     |                     |                          |\n(15) | When access_token   |                          |\n     | expires, MCP uses   |                          |\n     | refresh_token to    |                          |\n     | get a new one       |                          |\n     |--------------------&gt;|                          |\n     |                     |                          |\n(16) | Azure AD returns    |                          |\n     | new access_token    |                          |\n     |&lt;--------------------|                          |\n     |                     |                          |\n(17) | MCP continues to    |                          |\n     | operate until user  |                          |\n     | revokes consent or  |                          |\n     | tokens expire       |                          |\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Step Highlights<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>PKCE<\/strong> (Steps 2 &amp; 9) \u2014 Prevents interception of the authorization code.<\/li>\n\n\n\n<li><strong>State<\/strong> (Steps 3 &amp; 8) \u2014 Protects against CSRF attacks.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"559\" height=\"1024\" src=\"https:\/\/roboticsmaestro.com\/ai\/wp-content\/uploads\/2026\/09\/oauth-mcp-AAD-559x1024.jpg\" alt=\"\" class=\"wp-image-112\" srcset=\"https:\/\/roboticsmaestro.com\/ai\/wp-content\/uploads\/2026\/09\/oauth-mcp-AAD-559x1024.jpg 559w, https:\/\/roboticsmaestro.com\/ai\/wp-content\/uploads\/2026\/09\/oauth-mcp-AAD-164x300.jpg 164w, https:\/\/roboticsmaestro.com\/ai\/wp-content\/uploads\/2026\/09\/oauth-mcp-AAD-600x1099.jpg 600w, https:\/\/roboticsmaestro.com\/ai\/wp-content\/uploads\/2026\/09\/oauth-mcp-AAD.jpg 692w\" sizes=\"auto, (max-width: 559px) 100vw, 559px\" \/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Diagram Notes<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>PKCE<\/strong> steps (2, 9, 10) are critical for security in public clients like OpenWebUI MCP.<\/li>\n\n\n\n<li><strong>State validation<\/strong> (Step 8) prevents CSRF attacks.<\/li>\n\n\n\n<li><strong>Consent<\/strong> (Step 6) ensures the user explicitly approves scopes.<\/li>\n\n\n\n<li><strong>Refresh token<\/strong> cycle (Steps 15\u201316) keeps the session alive without re-login.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"341\" height=\"1024\" src=\"https:\/\/roboticsmaestro.com\/ai\/wp-content\/uploads\/2026\/09\/cftc-user-oauth2-openwebi-AAD-mcp-341x1024.jpg\" alt=\"\" class=\"wp-image-114\" srcset=\"https:\/\/roboticsmaestro.com\/ai\/wp-content\/uploads\/2026\/09\/cftc-user-oauth2-openwebi-AAD-mcp-341x1024.jpg 341w, https:\/\/roboticsmaestro.com\/ai\/wp-content\/uploads\/2026\/09\/cftc-user-oauth2-openwebi-AAD-mcp-100x300.jpg 100w, https:\/\/roboticsmaestro.com\/ai\/wp-content\/uploads\/2026\/09\/cftc-user-oauth2-openwebi-AAD-mcp-512x1536.jpg 512w, https:\/\/roboticsmaestro.com\/ai\/wp-content\/uploads\/2026\/09\/cftc-user-oauth2-openwebi-AAD-mcp-600x1801.jpg 600w, https:\/\/roboticsmaestro.com\/ai\/wp-content\/uploads\/2026\/09\/cftc-user-oauth2-openwebi-AAD-mcp.jpg 640w\" sizes=\"auto, (max-width: 341px) 100vw, 341px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Step 5<\/strong> is the decision point:\n<ul class=\"wp-block-list\">\n<li><strong>Success Path<\/strong> \u2192 User assigned \u2192 Flow continues to consent and token exchange.<\/li>\n\n\n\n<li><strong>Failure Path<\/strong> \u2192 User not assigned \u2192 Azure AD returns <strong>AADSTS50105<\/strong> and stops the flow.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>In the failure path, <strong>no authorization code<\/strong> is issued, so Steps 8\u201317 never occur.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>go all in and map out the full OAuth 2.0 Authorization Code with PKCE flow for your OpenWebUI MCP + Azure AD integration, showing every single step in the success path from the moment the user clicks \u201cConnect\u201d to when the MCP extension is fully authenticated. Full OAuth 2.0 Success Path \u2014 OpenWebUI MCP + [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_regular_price":[],"currency_symbol":[],"pagelayer_contact_templates":[],"_pagelayer_content":"","footnotes":""},"categories":[1],"tags":[],"class_list":["post-111","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"post_slider_layout_featured_media_urls":{"thumbnail":"","post_slider_layout_landscape_large":"","post_slider_layout_portrait_large":"","post_slider_layout_square_large":"","post_slider_layout_landscape":"","post_slider_layout_portrait":"","post_slider_layout_square":"","full":""},"_links":{"self":[{"href":"https:\/\/roboticsmaestro.com\/ai\/wp-json\/wp\/v2\/posts\/111","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/roboticsmaestro.com\/ai\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/roboticsmaestro.com\/ai\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/roboticsmaestro.com\/ai\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/roboticsmaestro.com\/ai\/wp-json\/wp\/v2\/comments?post=111"}],"version-history":[{"count":3,"href":"https:\/\/roboticsmaestro.com\/ai\/wp-json\/wp\/v2\/posts\/111\/revisions"}],"predecessor-version":[{"id":116,"href":"https:\/\/roboticsmaestro.com\/ai\/wp-json\/wp\/v2\/posts\/111\/revisions\/116"}],"wp:attachment":[{"href":"https:\/\/roboticsmaestro.com\/ai\/wp-json\/wp\/v2\/media?parent=111"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/roboticsmaestro.com\/ai\/wp-json\/wp\/v2\/categories?post=111"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/roboticsmaestro.com\/ai\/wp-json\/wp\/v2\/tags?post=111"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}